Patch Management

Based on official sourcesISMSISMS-PCheckpoints 5Evidence 3Cases 3

Certification criterion

The latest patches shall be applied to prevent security incidents caused by vulnerabilities in software, operating systems, security systems, and the like. However, where applying the latest patches is difficult after reviewing the service impact, separate supplementary measures shall be established and implemented.

Key checkpoints

Are patch management policies and procedures for operating systems (OS) and software established and implemented according to the characteristics and importance of each asset, such as servers, network systems, security systems, and PCs?
For major servers, network systems, security systems, and the like, is the status of OS and software patch application periodically managed?
Where applying the latest patches to remediate vulnerabilities is difficult due to service impact or similar factors, are supplementary measures established?
For major servers, network systems, security systems, and the like, is patching via public internet access restricted?
Where a patch management system is used, are sufficient protective measures such as access control established?

Detailed explanation

Patch management policies and procedures for OS and software shall be established and implemented according to the characteristics and importance of each asset, such as servers, network systems, security systems, and PCs.

Patch application targets: servers, network systems, DBMS, applications, commercial software, open source, security systems, PCs, and the like
Patch cycle: reflecting asset importance and characteristics
Method of checking patch information
Pre-review procedure before patch distribution
Emergency patch application procedure
Security review when a patch is not applied
Patch officer and responsible person
Contact information for patch-related vendors (manufacturers), and the like

For major servers, network systems, security systems, and the like, the status of installed OS and software patch application shall be periodically managed.

Manage as a list so that version information, patch application status, and application dates per patch of the operating systems and software installed on major servers, network systems, security systems, and the like can be checked
Periodically check whether the latest security patches need to be applied

※ Sites for checking the end of service support (EOS or EOL) date by major OS (examples)

MS Windows: https://support.microsoft.com/ko-kr/lifecycle/search
Red Hat Linux: https://access.redhat.com/support/policy/updates/errata
CentOS: https://wiki.centos.org/About/Product
AIX: https://www-01.ibm.com/support/docview.wss?uid=isg3T1012517
HP-UX: https://hpe.com/info/hpuxservermatrix
Solaris: https://www.oracle.com/technetwork/server-storage/solaris/overview/releases-jsp-140987.html

Where applying the latest patches to remediate vulnerabilities is difficult due to service impact or similar factors, supplementary measures shall be established.

Applying patches to an operational system may affect system availability, so apply patches only after sufficiently analyzing the impact through impact analysis and similar steps in accordance with the defined procedure, taking into account the importance and characteristics of the operational system
Where immediate patch application is difficult depending on the operating environment, establish the reason and additional supplementary measures, report them to the responsible person, and manage their status

For major servers, network systems, security systems, and the like, patching via public internet access shall be restricted.

However, where unavoidable, establish protective measures through prior risk analysis and apply them after approval by the responsible person

Where a patch management system (PMS) is used, it may be exploited as a malicious code distribution point targeting internal network servers or PCs, so sufficient protective measures such as access control shall be established for the patch management system server, management console, and the like.

Access control measures for the patch management system itself: blocking access by anyone other than authorized administrators, changing default passwords, removing security vulnerabilities, and the like
Integrity checks of files when distributing update files, and the like

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 9 (Prevention of malicious programs, etc.)

Evidence (examples)

Patch application management policy/procedure
Patch application status by system
Results of impact analysis related to patch application

Nonconformity examples

A case where, on some systems, an OS patch has not been applied for a long period without a valid reason or approval by the responsible person
A case where an OS version whose service support has ended (EOS) is in use on some systems, but no corresponding response plan or supplementary measures have been established
A case where the latest patches are applied to commercial software and OS, but no procedure or officer is designated to check and apply the latest patches for open source programs (openssl, openssh, Apache, etc.), so the latest security patches are not applied